Re: Open issues on the Crypto-Agility Requirements draft

[Alan DeKok <aland@deployingradius.com>]

Bernard Aboba wrote:
> My understanding is that many Diameter deployments use no security at all,
> making them much *less* secure than RADIUS.

  I've seen that, too.

> And these deployments are with NASes that are considerably more expensive
> than a mass market access point. 
> 
> I'm not sure whether the issue is operational (too hard to configure) or
> with the implementation. 
> 
> But something, somewhere, appears to have gone very wrong.

  It's harder to insert traffic into a TCP connection than to forge UDP
packets.  But it's not impossible.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>